6f158777c3a3032c451cda59c2f58abb5ae353c28fb96991d016e62afb4e8122

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 14:28

Target

0e42d36ee9834c3f0679008941110fa0_NeikiAnalytics.dll
Size

81KB
MD5

0e42d36ee9834c3f0679008941110fa0
SHA1

fc5cdaa3d5414626e1acb993261a8efead15c6ad
SHA256

6f158777c3a3032c451cda59c2f58abb5ae353c28fb96991d016e62afb4e8122
SHA512

66a0b0db477f545bbd8301adc7a133f3014185439234e9817f3ffb60fa6b1c8c6d165dc8e3575495f080a725ad16a555f79d75a177fc2d162a523f42e23ca2ad
SSDEEP

1536:FtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WN:F4v4JKXTx71w0ArSsXF3enq8WN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3036	1784	rundll32.exe	28
PID 1784 wrote to memory of 3036	1784	rundll32.exe	28
PID 1784 wrote to memory of 3036	1784	rundll32.exe	28
PID 1784 wrote to memory of 3036	1784	rundll32.exe	28
PID 1784 wrote to memory of 3036	1784	rundll32.exe	28
PID 1784 wrote to memory of 3036	1784	rundll32.exe	28
PID 1784 wrote to memory of 3036	1784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e42d36ee9834c3f0679008941110fa0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e42d36ee9834c3f0679008941110fa0_NeikiAnalytics.dll,#1
  2⤵
  PID:3036